Trojanized mathjs clone. lusolve() calls removeSolveValidation(), which calls is.isGraph(): it AES-256-GCM-decrypts a filename and a module from bundled ciphertext (utils/graph.js, utils/fraction.js, utils/bignumber/type.js), writes the plaintext to disk and require()s it, executing attacker-supplied code in the Node process. The decryption key is derived from caller-supplied matrix data, so the payload cannot be decrypted without the trigger. The loader exists only in the CommonJS build and is absent from the package's public GitHub source.